An incident is the worst possible time to learn how to handle one. Teams, both as collective and as individuals, need to be ready to respond to a rapidly changing set of threat actors, but many are still very reliant on their SIEM and EDR. This can be a vulnerability, especially if a threat actor circumvents that tooling.When a compromise occurs, responders need to already know what to collect, where to look, and what actions to take, even if an incident evades those traditional tools. This is more important now than ever: attackers are moving faster every year, and the time from initial access to impact keeps shrinking. 2025 was one of the most active ransomware years on record, with the average cybercrime breakout time at around 29 minutes.
Responders need to have built the capability before they need it.
That’s why we’ve built the Windows Incident Response & Forensics path. It focuses on strengthening team defences one responder at a time with deep, self-paced individual learning that each member of your team can work through at their own pace to build real incident response skills that build real readiness.
Why Windows Incident Response & Forensics
In short, to help security leaders provide assurance internally and externally on whether their team is prepared to handle a real Windows incident end to end.The path (complementing team pressure-testing through the Live Breach incident response cyber range) gives leaders clear evidence for internal leadership, clients, partners and regulators that the team has real understanding through engagement with a realistic environment, rather than passive consumption of theoretical information.After completion of the path, a responder can independently conduct incident response in large Active Directory environments, with a clear understanding of what they’re doing, why, and how each step contributes to the investigation. That demonstrable, trained capability, can be validated live, for example in Live Breach.
The individual-study half of readiness
Live Breach shows how a team performs and coordinates together, under pressure in the cyber range
This path is the individual study component beneath supporting team capability: each responder building the depth of knowledge and hands-on skill that team performance rests on
These are two halves of one feedback loop: individuals build skill in the path, the team proves their capability in the cyber range, gaps are surfaced. Those gaps can point back to the relevant modules to reinforce individual skill and close them.
Designed to support team mobility
The Windows Incident Response & Forensics path supports the growth and sharpening of incident response talent, from within and outside incident response teams. It’s a great, albeit challenging path for SOC analysts, threat hunters and offensive practitioners looking to move into DFIR. Because it covers the entirety of incident response and attack lifecycles step by step, it offers enough knowledge and hands-on skills to enter the domain.
It’s also modular, divided by attacker stages, so experienced responders can drop into particular focus areas based on their capability gaps, such as a specific Kerberos ticket attack or privilege-escalation technique they just encountered in a real incident. That lets an experienced team redistribute weight from a few specialists and prevent a single point of failure or burnout.
Who we built Windows IR and Forensics for
This is advanced, professional-level content, labelled Hard on the platform. It’s built for security professionals going deep into IR and digital forensics in complex Windows environments, and for those who want to master specific real-world attacker techniques and how to detect, contain, and prevent them. That makes it relevant across the roles on a modern defense team: incident responders, forensic analysts, SOC analysts (L2–L3), threat hunters, detection engineers, security researchers, and red-teamers moving to defense. It’s not entry-level; it’s professional content for people ready to work real investigations. And it isn’t only for practitioners: managers have told us this is the content they’ll be following themselves, a way to stay current for those in leadership roles who are finding more distance from the practical work.
What it covers: the full incident, end to end
The path is built to be the responder’s companion throughout an investigation, offering practical guidance on what data to collect, how to analyse it using logs and DFIR artifacts, and, crucially, which containment and remediation actions the findings call for.
It’s one of the most comprehensive and detailed Windows IR and forensics paths available, covering more than 100 attacker techniques seen in real incidents. Those techniques are built around genuine DFIR experience and mapped against DFIR reports from leading vendors, and they tie to the behaviour of real threat actor groups, from ransomware crews to espionage groups. It goes well beyond textbook scenarios, with extensive MITRE ATT&CK mapping throughout, and is designed to cover over 90% of what responders are likely to see in the wild.
Its signature structure combines the IR lifecycle with the kill chain, so at every stage learners see both what the attacker is doing and what the responder should do to detect, investigate, contain, and remediate it. Every core room follows the same arc: understand how the attacker performs a technique, detect it using logs and DFIR artifacts, then take the right containment and remediation actions to resolve the incident and prevent recurrence.
That structure plays out across 13 modules that walk the full attacker kill chain in the order a real incident unfolds: from initial access and execution, through persistence, credential access, privilege escalation, domain compromise, and lateral movement, and on to exfiltration and impact. By the end, learners know how to investigate the full attack chain from initial access to impact, detect and mitigate real-world techniques, master Windows memory, file system, and timeline analysis, and scale investigations across an entire enterprise.
| Module | What it covers | Why it matters |
|---|---|---|
| Accessing and Collecting Data | Accessing a compromised Windows environment and performing live and targeted forensic data acquisition and triage | Incident response starts with evidence: you can't investigate what you didn't collect |
| Initial Access and Execution | Investigating initial access and code execution: valid credential abuse, public-facing exploitation, PowerShell, LOLBins and fileless malware | Catching the entry point early limits the blast radius of an attack |
| Persistence Mechanisms | Detecting Windows persistence: scheduled tasks, run keys, malicious services, WMI event consumers, DLL abuse and external remote services | Persistence survives reboots and is easily missed; the attacker returns if you miss it |
| Credential Access | Investigating credential theft: LSASS memory dumping, SAM, NTDS and LSA secrets extraction | Stolen Windows credentials can turn one compromised host into many |
| Privilege Escalation | Identifying Windows privilege escalation: service exploitation, UAC bypass, access token manipulation and DLL abuse | How an attacker turns a foothold into full control of a host |
| Domain Malicious Behaviours | Detecting Active Directory attacks: Kerberos ticket abuse (Kerberoasting, Pass-the-Ticket, Golden, Silver and Diamond Tickets) and Active Directory Certificate Services (ADCS) abuse | Can lead to full domain compromise, using techniques that routinely evade SIEM and EDR |
| Lateral Movement & Pivoting | Investigating lateral movement across Windows: SMB, PsExec, WinRM, WMI, scheduled tasks, RDP and RMM tools | Tracing attacker movement across multiple hosts, not just the first one compromised |
| Exfiltration and Impact | Investigating data discovery, collection, exfiltration, attacker infrastructure and ransomware operations | Response speed matters most here |
| Memory Analysis | Windows memory forensics: analysing processes, user activity and network connections in RAM | Uncovers malicious activity that is easily missed |
| Advanced Memory Analysis | Advanced memory forensics: process objects, code injection, process hollowing, malicious drivers and rootkits | Finds techniques attackers work hardest to hide |
| Advanced File System Analysis | Low-level Windows file system forensics: FAT32, NTFS, advanced NTFS analysis and file carving | Recovers deleted and fragmented evidence that other investigations miss |
| Scaling and Timeline Analysis | Scaling incident response across the enterprise with automated forensic collection and timeline analysis using Velociraptor and Plaso | The jump from single-host investigation to enterprise-wide incident response |
| Incident Reporting & Summary | Writing high-quality incident reports for technical and executive audiences, and summarizing how this path impacts you and your team | Knowing how and where to put your new skills to work |
Want to see how the Windows Incident Response & Forensics learning path team builds readiness, one responder at a time? Explore the path.
Joanna Duffy
